linux-kernel - Re: [f2fs-dev] [PATCH] f2fs: return -EPERM given generic mask

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 10 May 2021 07:39:47 -0700
From:   Jaegeuk Kim <jaegeuk@...nel.org>
To:     Eric Biggers <ebiggers@...nel.org>
Cc:     linux-kernel@...r.kernel.org,
        linux-f2fs-devel@...ts.sourceforge.net
Subject: Re: [f2fs-dev] [PATCH] f2fs: return -EPERM given generic mask

On 05/06, Eric Biggers wrote:
> On Thu, May 06, 2021 at 12:13:47PM -0700, Jaegeuk Kim wrote:
> > In f2fs_fileattr_set(),
> > 
> > 	if (!fa->flags_valid)
> > 		mask &= FS_COMMON_FL;
> > 
> > In this case, we should not allow to set FS_COMPR_FL, instead of BUG_ON.
> > 
> > /* Flags shared betwen flags/xflags */
> > 	(FS_SYNC_FL | FS_IMMUTABLE_FL | FS_APPEND_FL | \
> > 	 FS_NODUMP_FL |	FS_NOATIME_FL | FS_DAX_FL | \
> > 	 FS_PROJINHERIT_FL)
> > 
> > Fixes: 4c5b47997521 ("vfs: add fileattr ops")
> > Signed-off-by: Jaegeuk Kim <jaegeuk@...nel.org>
> > ---
> >  fs/f2fs/file.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
> > index e01ce802cf10..38015ef84893 100644
> > --- a/fs/f2fs/file.c
> > +++ b/fs/f2fs/file.c
> > @@ -1817,7 +1817,9 @@ static int f2fs_setflags_common(struct inode *inode, u32 iflags, u32 mask)
> >  	struct f2fs_inode_info *fi = F2FS_I(inode);
> >  	u32 masked_flags = fi->i_flags & mask;
> >  
> > -	f2fs_bug_on(F2FS_I_SB(inode), (iflags & ~mask));
> > +	/* mask can be shrunk by flags_valid selector */
> > +	if (iflags & ~mask)
> > +		return -EPERM;
> >  
> >  	/* Is it quota file? Do not allow user to mess with it */
> >  	if (IS_NOQUOTA(inode))
> > -- 
> > 2.31.1.607.g51e8a6a459-goog
> 
> This looks like the wrong fix.  AFAICS, 'mask' is the set of inode flags that
> the specific ioctl (FS_IOC_SETFLAGS or FS_IOC_FSSETXATTR) can potentially
> modify, while 'iflags' is the new set of inode flags among the set that either
> ioctl can potentially modify.  So this change will stop FS_IOC_FSSETXATTR from
> working on files that have already flags set which are only modifiable by
> FS_IOC_SETFLAGS, e.g. the compression flag.
> 
> I think the correct fix would be to just do something like 'iflags &= mask'.

Thanks. Let me send v2.

> 
> - Eric